> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Operator Guide

Operator access is built from two layers: a **System Operator** system role and
an **Organization Operator** organization role. The organization role is what
grants day-to-day Workbench access inside a specific organization. See
[Role Model](https://www.jumpserver.com/docs/roles/role-model.md) for the general model.

## Operator roles

| Role                  | Scope        | What it grants                                                           |
| --------------------- | ------------ | ------------------------------------------------------------------------ |
| System Operator       | System       | General baseline role; intended to be combined with an organization role |
| Organization Operator | Organization | Workbench within one organization                                        |


Note

System Operator alone is not a complete operations role. Assign
**Organization Operator** in the organization where the user needs to connect to
assets and perform day-to-day work.

## System Operator baseline

The system role provides the personal and cross-organization baseline used with
an organization role:

- [Profile](https://www.jumpserver.com/docs/features/general/account/profile.md), [Preferences](https://www.jumpserver.com/docs/features/general/account/preferences.md), and [Notifications](https://www.jumpserver.com/docs/features/general/workspace/notifications.md)
- [Access Keys](https://www.jumpserver.com/docs/features/general/account/access-keys.md) and [Tokens](https://www.jumpserver.com/docs/features/general/account/tokens.md)
- [Workbench Overview](https://www.jumpserver.com/docs/features/workbench/index.md) and the Workbench entry
- [JumpServer Client](https://www.jumpserver.com/docs/features/client/index.md) and [Asset Connection](https://www.jumpserver.com/docs/features/client/asset-connection.md)

## Organization Operator

Organization Operator uses **Workbench** inside the assigned organization. It
does not administer users, assets, authorizations, or platform settings.

### Workbench

- [Overview](https://www.jumpserver.com/docs/features/workbench/index.md)
- [Access Assets](https://www.jumpserver.com/docs/features/workbench/my-assets/access-assets.md)
- [File Transfer](https://www.jumpserver.com/docs/features/workbench/my-assets/file-transfer.md)
- [Personal Credentials](https://www.jumpserver.com/docs/features/workbench/my-assets/personal-credentials.md)
- [Job Center](https://www.jumpserver.com/docs/features/workbench/job-center/index.md) — Adhoc, Jobs, Templates, and Execution History
- [Tickets & Approvals](https://www.jumpserver.com/docs/features/workbench/tickets/index.md) — Submitted and Assigned tickets
- [Tools](https://www.jumpserver.com/docs/features/workbench/tools.md)

### Client

- [Client Overview](https://www.jumpserver.com/docs/features/client/index.md) — desktop client features and requirements
- [Asset Connection](https://www.jumpserver.com/docs/features/client/asset-connection.md) — Linux, Windows, database, and web assets
- [Connection Settings](https://www.jumpserver.com/docs/features/client/connection-settings.md) — local preferences and application paths

### General

- [Global Search](https://www.jumpserver.com/docs/features/general/workspace/global-search.md)
- [Notifications](https://www.jumpserver.com/docs/features/general/workspace/notifications.md)
- [Profile](https://www.jumpserver.com/docs/features/general/account/profile.md)
- [AI Assistant](https://www.jumpserver.com/docs/features/general/support/ai-assistant.md) when enabled for the deployment

## Scope boundaries

- Console administration, PAM lifecycle automation, Audits, and System Settings
  are not part of Organization Operator by default.
- **Flow Setup** in Workbench > Tickets & Approvals is an administrative
  configuration, not an operator task. Operators use **Submitted** and
  **Assigned**.
- To use Workbench in another organization, assign Organization Operator there
  and switch organizations.

## Assigning operator roles

1. Assign **System Operator** as the user's system role when a baseline account
   is required.
2. Invite the user to the target organization with **Organization Operator**.
3. Switch organizations to confirm the Workbench shows the expected authorized
   assets.